36 files changed, 233 insertions, 156 deletions
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 77bcd4cb4ffb..463b9ec57d80 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1278,7 +1278,7 @@ struct bnx2x {
 #define BNX2X_FW_RX_ALIGN_START (1UL << BNX2X_RX_ALIGN_SHIFT)
 #define BNX2X_FW_RX_ALIGN_END                                   \
-        max(1UL << BNX2X_RX_ALIGN_SHIFT,                        \
+        max_t(u64, 1UL << BNX2X_RX_ALIGN_SHIFT,                 \
            SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 #define BNX2X_PXP_DRAM_ALIGN            (BNX2X_RX_ALIGN_SHIFT - 5)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index dd451c3dd83d..02b5a343b195 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4041,20 +4041,6 @@ static bool bnx2x_get_load_status(struct bnx2x *bp, int engine)
        return val != 0;
 }
-/*
- * Reset the load status for the current engine.
- */
-static void bnx2x_clear_load_status(struct bnx2x *bp)
-{
-        u32 val;
-        u32 mask = (BP_PATH(bp) ? BNX2X_PATH1_LOAD_CNT_MASK :
-                    BNX2X_PATH0_LOAD_CNT_MASK);
-        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RECOVERY_REG);
-        val = REG_RD(bp, BNX2X_RECOVERY_GLOB_REG);
-        REG_WR(bp, BNX2X_RECOVERY_GLOB_REG, val & (~mask));
-        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RECOVERY_REG);
-}
 static void _print_next_block(int idx, const char *blk)
 {
        pr_cont("%s%s", idx ? ", " : "", blk);
@@ -9384,32 +9370,24 @@ static int __devinit bnx2x_prev_mark_path(struct bnx2x *bp)
        return rc;
 }
-static bool __devinit bnx2x_can_flr(struct bnx2x *bp)
-{
-        int pos;
-        u32 cap;
-        struct pci_dev *dev = bp->pdev;
-        pos = pci_pcie_cap(dev);
-        if (!pos)
-                return false;
-        pci_read_config_dword(dev, pos + PCI_EXP_DEVCAP, &cap);
-        if (!(cap & PCI_EXP_DEVCAP_FLR))
-                return false;
-        return true;
-}
 static int __devinit bnx2x_do_flr(struct bnx2x *bp)
 {
        int i, pos;
        u16 status;
        struct pci_dev *dev = bp->pdev;
-        /* probe the capability first */
-        if (bnx2x_can_flr(bp))
+        if (CHIP_IS_E1x(bp)) {
-                return -ENOTTY;
+                BNX2X_DEV_INFO("FLR not supported in E1/E1H\n");
+                return -EINVAL;
+        }
+        /* only bootcode REQ_BC_VER_4_INITIATE_FLR and onwards support flr */
+        if (bp->common.bc_ver < REQ_BC_VER_4_INITIATE_FLR) {
+                BNX2X_ERR("FLR not supported by BC_VER: 0x%x\n",
+                          bp->common.bc_ver);
+                return -EINVAL;
+        }
        pos = pci_pcie_cap(dev);
        if (!pos)
@@ -9429,12 +9407,8 @@ static int __devinit bnx2x_do_flr(struct bnx2x *bp)
                "transaction is not cleared; proceeding with reset anyway\n");
 clear:
-        if (bp->common.bc_ver < REQ_BC_VER_4_INITIATE_FLR) {
-                BNX2X_ERR("FLR not supported by BC_VER: 0x%x\n",
-                          bp->common.bc_ver);
-                return -EINVAL;
-        }
+        BNX2X_DEV_INFO("Initiating FLR\n");
        bnx2x_fw_command(bp, DRV_MSG_CODE_INITIATE_FLR, 0);
        return 0;
@@ -9454,8 +9428,21 @@ static int __devinit bnx2x_prev_unload_uncommon(struct bnx2x *bp)
         * the one required, then FLR will be sufficient to clean any residue
         * left by previous driver
         */
-        if (bnx2x_test_firmware_version(bp, false) && bnx2x_can_flr(bp))
+        rc = bnx2x_test_firmware_version(bp, false);
-                return bnx2x_do_flr(bp);
+        if (!rc) {
+                /* fw version is good */
+                BNX2X_DEV_INFO("FW version matches our own. Attempting FLR\n");
+                rc = bnx2x_do_flr(bp);
+        }
+        if (!rc) {
+                /* FLR was performed */
+                BNX2X_DEV_INFO("FLR successful\n");
+                return 0;
+        }
+        BNX2X_DEV_INFO("Could not FLR\n");
        /* Close the MCP request, return failure*/
        rc = bnx2x_prev_mcp_done(bp);
@@ -11427,9 +11414,6 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
        if (!chip_is_e1x)
                REG_WR(bp, PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_READ, 1);
-        /* Reset the load counter */
-        bnx2x_clear_load_status(bp);
        dev->watchdog_timeo = TX_TIMEOUT;
        dev->netdev_ops = &bnx2x_netdev_ops;
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 0b3bade957fd..080c89093feb 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -999,7 +999,7 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active)
 **/
 static s32 e1000_reset_hw_82571(struct e1000_hw *hw)
 {
-        u32 ctrl, ctrl_ext, eecd;
+        u32 ctrl, ctrl_ext, eecd, tctl;
        s32 ret_val;
        /*
@@ -1014,7 +1014,9 @@ static s32 e1000_reset_hw_82571(struct e1000_hw *hw)
        ew32(IMC, 0xffffffff);
        ew32(RCTL, 0);
-        ew32(TCTL, E1000_TCTL_PSP);
+        tctl = er32(TCTL);
+        tctl &= ~E1000_TCTL_EN;
+        ew32(TCTL, tctl);
        e1e_flush();
        usleep_range(10000, 20000);
@@ -1601,10 +1603,8 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
                         * auto-negotiation in the TXCW register and disable
                         * forced link in the Device Control register in an
                         * attempt to auto-negotiate with our link partner.
-                         * If the partner code word is null, stop forcing
-                         * and restart auto negotiation.
                         */
-                        if ((rxcw & E1000_RXCW_C) || !(rxcw & E1000_RXCW_CW))  {
+                        if (rxcw & E1000_RXCW_C) {
                                /* Enable autoneg, and unforce link up */
                                ew32(TXCW, mac->txcw);
                                ew32(CTRL, (ctrl & ~E1000_CTRL_SLU));
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 95b245310f17..46c3b1f9ff89 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -178,6 +178,24 @@ static void e1000_regdump(struct e1000_hw *hw, struct e1000_reg_info *reginfo)
        pr_info("%-15s %08x %08x\n", rname, regs[0], regs[1]);
 }
+static void e1000e_dump_ps_pages(struct e1000_adapter *adapter,
+                                 struct e1000_buffer *bi)
+{
+        int i;
+        struct e1000_ps_page *ps_page;
+        for (i = 0; i < adapter->rx_ps_pages; i++) {
+                ps_page = &bi->ps_pages[i];
+                if (ps_page->page) {
+                        pr_info("packet dump for ps_page %d:\n", i);
+                        print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS,
+                                       16, 1, page_address(ps_page->page),
+                                       PAGE_SIZE, true);
+                }
+        }
+}
 /*
 * e1000e_dump - Print registers, Tx-ring and Rx-ring
 */
@@ -299,10 +317,10 @@ static void e1000e_dump(struct e1000_adapter *adapter)
                        (unsigned long long)buffer_info->time_stamp,
                        buffer_info->skb, next_desc);
-                if (netif_msg_pktdata(adapter) && buffer_info->dma != 0)
+                if (netif_msg_pktdata(adapter) && buffer_info->skb)
                        print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS,
-                                       16, 1, phys_to_virt(buffer_info->dma),
+                                       16, 1, buffer_info->skb->data,
-                                       buffer_info->length, true);
+                                       buffer_info->skb->len, true);
        }
        /* Print Rx Ring Summary */
@@ -381,10 +399,8 @@ rx_ring_summary:
                                        buffer_info->skb, next_desc);
                                if (netif_msg_pktdata(adapter))
-                                        print_hex_dump(KERN_INFO, "",
+                                        e1000e_dump_ps_pages(adapter,
-                                                DUMP_PREFIX_ADDRESS, 16, 1,
+                                                             buffer_info);
-                                                phys_to_virt(buffer_info->dma),
-                                                adapter->rx_ps_bsize0, true);
                        }
                }
                break;
@@ -444,12 +460,12 @@ rx_ring_summary:
                                        (unsigned long long)buffer_info->dma,
                                        buffer_info->skb, next_desc);
-                                if (netif_msg_pktdata(adapter))
+                                if (netif_msg_pktdata(adapter) &&
+                                    buffer_info->skb)
                                        print_hex_dump(KERN_INFO, "",
                                                       DUMP_PREFIX_ADDRESS, 16,
                                                       1,
-                                                       phys_to_virt
+                                                       buffer_info->skb->data,
-                                                       (buffer_info->dma),
                                                       adapter->rx_buffer_len,
                                                       true);
                        }
diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h b/drivers/net/ethernet/intel/igb/e1000_regs.h
index 10efcd88dca0..28394bea5253 100644
--- a/drivers/net/ethernet/intel/igb/e1000_regs.h
+++ b/drivers/net/ethernet/intel/igb/e1000_regs.h
@@ -156,8 +156,12 @@
                                    : (0x0E018 + ((_n) * 0x40)))
 #define E1000_TXDCTL(_n)  ((_n) < 4 ? (0x03828 + ((_n) * 0x100)) \
                                    : (0x0E028 + ((_n) * 0x40)))
-#define E1000_DCA_TXCTRL(_n) (0x03814 + (_n << 8))
+#define E1000_RXCTL(_n)   ((_n) < 4 ? (0x02814 + ((_n) * 0x100)) : \
-#define E1000_DCA_RXCTRL(_n) (0x02814 + (_n << 8))
+                                      (0x0C014 + ((_n) * 0x40)))
+#define E1000_DCA_RXCTRL(_n)    E1000_RXCTL(_n)
+#define E1000_TXCTL(_n)   ((_n) < 4 ? (0x03814 + ((_n) * 0x100)) : \
+                                      (0x0E014 + ((_n) * 0x40)))
+#define E1000_DCA_TXCTRL(_n) E1000_TXCTL(_n)
 #define E1000_TDWBAL(_n)  ((_n) < 4 ? (0x03838 + ((_n) * 0x100)) \
                                    : (0x0E038 + ((_n) * 0x40)))
 #define E1000_TDWBAH(_n)  ((_n) < 4 ? (0x0383C + ((_n) * 0x100)) \
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 90550f5e3dd9..70591117051b 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1498,6 +1498,9 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
                break;
        }
+        /* add small delay to avoid loopback test failure */
+        msleep(50);
        /* force 1000, set loopback */
        igb_write_phy_reg(hw, PHY_CONTROL, 0x4140);
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index b7c2d5050572..48cc4fb1a307 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -462,10 +462,10 @@ static void igb_dump(struct igb_adapter *adapter)
                                (u64)buffer_info->time_stamp,
                                buffer_info->skb, next_desc);
-                        if (netif_msg_pktdata(adapter) && buffer_info->dma != 0)
+                        if (netif_msg_pktdata(adapter) && buffer_info->skb)
                                print_hex_dump(KERN_INFO, "",
                                        DUMP_PREFIX_ADDRESS,
-                                        16, 1, phys_to_virt(buffer_info->dma),
+                                        16, 1, buffer_info->skb->data,
                                        buffer_info->length, true);
                }
        }
@@ -547,18 +547,17 @@ rx_ring_summary:
                                        (u64)buffer_info->dma,
                                        buffer_info->skb, next_desc);
-                                if (netif_msg_pktdata(adapter)) {
+                                if (netif_msg_pktdata(adapter) &&
+                                    buffer_info->dma && buffer_info->skb) {
                                        print_hex_dump(KERN_INFO, "",
-                                                DUMP_PREFIX_ADDRESS,
+                                                  DUMP_PREFIX_ADDRESS,
-                                                16, 1,
+                                                  16, 1, buffer_info->skb->data,
-                                                phys_to_virt(buffer_info->dma),
+                                                  IGB_RX_HDR_LEN, true);
-                                                IGB_RX_HDR_LEN, true);
                                        print_hex_dump(KERN_INFO, "",
                                          DUMP_PREFIX_ADDRESS,
                                          16, 1,
-                                          phys_to_virt(
+                                          page_address(buffer_info->page) +
-                                            buffer_info->page_dma +
+                                                      buffer_info->page_offset,
-                                            buffer_info->page_offset),
                                          PAGE_SIZE/2, true);
                                }
                        }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
index 50fc137501da..18bf08c9d7a4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
@@ -804,12 +804,13 @@ static s32 ixgbe_setup_mac_link_82599(struct ixgbe_hw *hw,
            link_mode == IXGBE_AUTOC_LMS_KX4_KX_KR_SGMII) {
                /* Set KX4/KX/KR support according to speed requested */
                autoc &= ~(IXGBE_AUTOC_KX4_KX_SUPP_MASK | IXGBE_AUTOC_KR_SUPP);
-                if (speed & IXGBE_LINK_SPEED_10GB_FULL)
+                if (speed & IXGBE_LINK_SPEED_10GB_FULL) {
                        if (orig_autoc & IXGBE_AUTOC_KX4_SUPP)
                                autoc |= IXGBE_AUTOC_KX4_SUPP;
                        if ((orig_autoc & IXGBE_AUTOC_KR_SUPP) &&
                            (hw->phy.smart_speed_active == false))
                                autoc |= IXGBE_AUTOC_KR_SUPP;
+                }
                if (speed & IXGBE_LINK_SPEED_1GB_FULL)
                        autoc |= IXGBE_AUTOC_KX_SUPP;
        } else if ((pma_pmd_1g == IXGBE_AUTOC_1G_SFI) &&
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 4069edab229e..53743f7a2ca9 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -346,28 +346,15 @@ static phy_interface_t lpc_phy_interface_mode(struct device *dev)
                                                   "phy-mode", NULL);
                if (mode && !strcmp(mode, "mii"))
                        return PHY_INTERFACE_MODE_MII;
-                return PHY_INTERFACE_MODE_RMII;
        }
-        /* non-DT */
-#ifdef CONFIG_ARCH_LPC32XX_MII_SUPPORT
-        return PHY_INTERFACE_MODE_MII;
-#else
        return PHY_INTERFACE_MODE_RMII;
-#endif
 }
 static bool use_iram_for_net(struct device *dev)
 {
        if (dev && dev->of_node)
                return of_property_read_bool(dev->of_node, "use-iram");
-        /* non-DT */
-#ifdef CONFIG_ARCH_LPC32XX_IRAM_FOR_NET
-        return true;
-#else
        return false;
-#endif
 }
 /* Receive Status information word */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index cd01ee7ecef1..b93245c11995 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -74,7 +74,7 @@ static int __devinit stmmac_probe_config_dt(struct platform_device *pdev,
 * the necessary resources and invokes the main to init
 * the net device, register the mdio bus etc.
 */
-static int stmmac_pltfr_probe(struct platform_device *pdev)
+static int __devinit stmmac_pltfr_probe(struct platform_device *pdev)
 {
        int ret = 0;
        struct resource *res;
diff --git a/drivers/net/irda/bfin_sir.c b/drivers/net/irda/bfin_sir.c
index a561ae44a9ac..c6a0299aa9f9 100644
--- a/drivers/net/irda/bfin_sir.c
+++ b/drivers/net/irda/bfin_sir.c
@@ -158,7 +158,7 @@ static int bfin_sir_set_speed(struct bfin_sir_port *port, int speed)
        /* If not add the 'RPOLC', we can't catch the receive interrupt.
         * It's related with the HW layout and the IR transiver.
         */
-        val |= IREN | RPOLC;
+        val |= UMOD_IRDA | RPOLC;
        UART_PUT_GCTL(port, val);
        return ret;
 }
@@ -432,7 +432,7 @@ static void bfin_sir_shutdown(struct bfin_sir_port *port, struct net_device *dev
        bfin_sir_stop_rx(port);
        val = UART_GET_GCTL(port);
-        val &= ~(UCEN | IREN | RPOLC);
+        val &= ~(UCEN | UMOD_MASK | RPOLC);
        UART_PUT_GCTL(port, val);
 #ifdef CONFIG_SIR_BFIN_DMA
@@ -518,10 +518,10 @@ static void bfin_sir_send_work(struct work_struct *work)
         * reset all the UART.
         */
        val = UART_GET_GCTL(port);
-        val &= ~(IREN | RPOLC);
+        val &= ~(UMOD_MASK | RPOLC);
        UART_PUT_GCTL(port, val);
        SSYNC();
-        val |= IREN | RPOLC;
+        val |= UMOD_IRDA | RPOLC;
        UART_PUT_GCTL(port, val);
        SSYNC();
        /* bfin_sir_set_speed(port, self->speed); */
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 0737bd4d1669..0f0f9ce3a776 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -94,7 +94,8 @@ static int get_slot(struct macvlan_dev *vlan, struct macvtap_queue *q)
        int i;
        for (i = 0; i < MAX_MACVTAP_QUEUES; i++) {
-                if (rcu_dereference(vlan->taps[i]) == q)
+                if (rcu_dereference_protected(vlan->taps[i],
+                                              lockdep_is_held(&macvtap_lock)) == q)
                        return i;
        }
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 1c98321b56cc..162464fe86bf 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -189,7 +189,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        if (sk_pppox(po)->sk_state & PPPOX_DEAD)
                goto tx_error;
-        rt = ip_route_output_ports(&init_net, &fl4, NULL,
+        rt = ip_route_output_ports(sock_net(sk), &fl4, NULL,
                                   opt->dst_addr.sin_addr.s_addr,
                                   opt->src_addr.sin_addr.s_addr,
                                   0, 0, IPPROTO_GRE,
@@ -468,7 +468,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
        po->chan.private = sk;
        po->chan.ops = &pptp_chan_ops;
-        rt = ip_route_output_ports(&init_net, &fl4, sk,
+        rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
                                   opt->dst_addr.sin_addr.s_addr,
                                   opt->src_addr.sin_addr.s_addr,
                                   0, 0,
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 926d4db5cb38..3a16d4fdaa05 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -187,7 +187,6 @@ static void __tun_detach(struct tun_struct *tun)
        netif_tx_lock_bh(tun->dev);
        netif_carrier_off(tun->dev);
        tun->tfile = NULL;
-        tun->socket.file = NULL;
        netif_tx_unlock_bh(tun->dev);
        /* Drop read queue */
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 64610048ce87..7d78669000d7 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -232,6 +232,7 @@ static int usbpn_open(struct net_device *dev)
                struct urb *req = usb_alloc_urb(0, GFP_KERNEL);
                if (!req || rx_submit(pnd, req, GFP_KERNEL | __GFP_COLD)) {
+                        usb_free_urb(req);
                        usbpn_close(dev);
                        return -ENOMEM;
                }
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index 6fddd2785e6e..a82f46c10f5e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -707,11 +707,14 @@ static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
 */
 static bool rs_use_green(struct ieee80211_sta *sta)
 {
-        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        /*
-        struct iwl_rxon_context *ctx = sta_priv->ctx;
+         * There's a bug somewhere in this code that causes the
+         * scaling to get stuck because GF+SGI can't be combined
-        return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
+         * in SISO rates. Until we find that bug, disable GF, it
-                !(ctx->ht.non_gf_sta_present);
+         * has only limited benefit and we still interoperate with
+         * GF APs since we can always receive GF transmissions.
+         */
+        return false;
 }
 /**
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f32259686b45..3f7bc5cadf9a 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2243,8 +2243,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
 {
-        struct ieee80211_conf conf = { .flags = 0 };
+        struct rt2x00lib_conf libconf = { .conf = &rt2x00dev->hw->conf };
-        struct rt2x00lib_conf libconf = { .conf = &conf };
        rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
diff --git a/include/linux/can.h b/include/linux/can.h
index 018055efc034..e52958d7c2d1 100644
--- a/include/linux/can.h
+++ b/include/linux/can.h
@@ -74,20 +74,21 @@ struct can_frame {
 /*
 * defined bits for canfd_frame.flags
 *
- * As the default for CAN FD should be to support the high data rate in the
+ * The use of struct canfd_frame implies the Extended Data Length (EDL) bit to
- * payload section of the frame (HDR) and to support up to 64 byte in the
+ * be set in the CAN frame bitstream on the wire. The EDL bit switch turns
- * data section (EDL) the bits are only set in the non-default case.
+ * the CAN controllers bitstream processor into the CAN FD mode which creates
- * Btw. as long as there's no real implementation for CAN FD network driver
+ * two new options within the CAN FD frame specification:
- * these bits are only preliminary.
 *
- * RX: NOHDR/NOEDL - info about received CAN FD frame
+ * Bit Rate Switch - to indicate a second bitrate is/was used for the payload
- *     ESI         - bit from originating CAN controller
+ * Error State Indicator - represents the error state of the transmitting node
- * TX: NOHDR/NOEDL - control per-frame settings if supported by CAN controller
+ *
- *     ESI         - bit is set by local CAN controller
+ * As the CANFD_ESI bit is internally generated by the transmitting CAN
+ * controller only the CANFD_BRS bit is relevant for real CAN controllers when
+ * building a CAN FD frame for transmission. Setting the CANFD_ESI bit can make
+ * sense for virtual CAN interfaces to test applications with echoed frames.
 */
-#define CANFD_NOHDR 0x01 /* frame without high data rate */
+#define CANFD_BRS 0x01 /* bit rate switch (second bitrate for payload data) */
-#define CANFD_NOEDL 0x02 /* frame without extended data length */
+#define CANFD_ESI 0x02 /* error state indicator of the transmitting node */
-#define CANFD_ESI   0x04 /* error state indicator */
 /**
 * struct canfd_frame - CAN flexible data rate frame structure
diff --git a/include/net/codel.h b/include/net/codel.h
index 550debfc2403..389cf621161d 100644
--- a/include/net/codel.h
+++ b/include/net/codel.h
@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
                        }
                }
        } else if (drop) {
+                u32 delta;
                if (params->ecn && INET_ECN_set_ce(skb)) {
                        stats->ecn_mark++;
                } else {
@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
                 * assume that the drop rate that controlled the queue on the
                 * last cycle is a good starting point to control it now.
                 */
-                if (codel_time_before(now - vars->drop_next,
+                delta = vars->count - vars->lastcount;
+                if (delta > 1 &&
+                    codel_time_before(now - vars->drop_next,
                                      16 * params->interval)) {
-                        vars->count = (vars->count - vars->lastcount) | 1;
+                        vars->count = delta;
                        /* we dont care if rec_inv_sqrt approximation
                         * is not very precise :
                         * Next Newton steps will correct it quadratically.
diff --git a/include/net/dst.h b/include/net/dst.h
index baf597890064..621e3513ef5e 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -110,7 +110,7 @@ struct dst_entry {
 };
 extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
-extern const u32 dst_default_metrics[RTAX_MAX];
+extern const u32 dst_default_metrics[];
 #define DST_METRICS_READ_ONLY   0x1UL
 #define __DST_METRICS_PTR(Y)    \
diff --git a/include/net/ip.h b/include/net/ip.h
index bd5e444a19ce..5a5d84d3d2c6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -120,7 +120,7 @@ extern struct sk_buff  *__ip_make_skb(struct sock *sk,
                                      struct flowi4 *fl4,
                                      struct sk_buff_head *queue,
                                      struct inet_cork *cork);
-extern int              ip_send_skb(struct sk_buff *skb);
+extern int              ip_send_skb(struct net *net, struct sk_buff *skb);
 extern int              ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4);
 extern void             ip_flush_pending_frames(struct sock *sk);
 extern struct sk_buff  *ip_make_skb(struct sock *sk,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e19124b84cd2..1f000ffe7075 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -464,6 +464,7 @@ extern int tcp_disconnect(struct sock *sk, int flags);
 void tcp_connect_init(struct sock *sk);
 void tcp_finish_connect(struct sock *sk, struct sk_buff *skb);
 int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size);
+void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb);
 /* From syncookies.c */
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a438f4b582fc..99dd8f75b3ff 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -197,6 +197,7 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
 del:
                list_del(&entry->list);
                kfree(entry);
+                kfree(tt_change_node);
                event_removed = true;
                goto unlock;
        }
diff --git a/net/core/dev.c b/net/core/dev.c
index f91abf800161..a39354ee1432 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1055,6 +1055,8 @@ rollback:
 */
 int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
 {
+        char *new_ifalias;
        ASSERT_RTNL();
        if (len >= IFALIASZ)
@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
                return 0;
        }
-        dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+        new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-        if (!dev->ifalias)
+        if (!new_ifalias)
                return -ENOMEM;
+        dev->ifalias = new_ifalias;
        strlcpy(dev->ifalias, alias, len+1);
        return len;
diff --git a/net/core/dst.c b/net/core/dst.c
index 069d51d29414..56d63612e1e4 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -149,7 +149,15 @@ int dst_discard(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard);
-const u32 dst_default_metrics[RTAX_MAX];
+const u32 dst_default_metrics[RTAX_MAX + 1] = {
+        /* This initializer is needed to force linker to place this variable
+         * into const section. Otherwise it might end into bss section.
+         * We really want to avoid false sharing on this variable, and catch
+         * any writes on it.
+         */
+        [RTAX_MAX] = 0xdeadbeef,
+};
 void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
                int initial_ref, int initial_obsolete, unsigned short flags)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index f0cdb30921c0..57bd978483e1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -367,7 +367,7 @@ static void __leaf_free_rcu(struct rcu_head *head)
 static inline void free_leaf(struct leaf *l)
 {
-        call_rcu_bh(&l->rcu, __leaf_free_rcu);
+        call_rcu(&l->rcu, __leaf_free_rcu);
 }
 static inline void free_leaf_info(struct leaf_info *leaf)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 76dde25fb9a0..147ccc3e93db 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1366,9 +1366,8 @@ out:
        return skb;
 }
-int ip_send_skb(struct sk_buff *skb)
+int ip_send_skb(struct net *net, struct sk_buff *skb)
 {
-        struct net *net = sock_net(skb->sk);
        int err;
        err = ip_local_out(skb);
@@ -1391,7 +1390,7 @@ int ip_push_pending_frames(struct sock *sk, struct flowi4 *fl4)
                return 0;
        /* Netfilter gets whole the not fragmented skb. */
-        return ip_send_skb(skb);
+        return ip_send_skb(sock_net(sk), skb);
 }
 /*
@@ -1536,6 +1535,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
                          arg->csumoffset) = csum_fold(csum_add(nskb->csum,
                                                                arg->csum));
                nskb->ip_summed = CHECKSUM_NONE;
+                skb_orphan(nskb);
                skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
                ip_push_pending_frames(sk, &fl4);
        }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 272241f16fcb..767823764016 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1869,7 +1869,7 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
        .twsk_destructor= tcp_twsk_destructor,
 };
-static void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
        struct dst_entry *dst = skb_dst(skb);
@@ -1877,6 +1877,7 @@ static void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
        sk->sk_rx_dst = dst;
        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 }
+EXPORT_SYMBOL(inet_sk_rx_dst_set);
 const struct inet_connection_sock_af_ops ipv4_specific = {
        .queue_xmit        = ip_queue_xmit,
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 2288a6399e1e..0abe67bb4d3a 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -731,6 +731,18 @@ static int __net_init tcp_net_metrics_init(struct net *net)
 static void __net_exit tcp_net_metrics_exit(struct net *net)
 {
+        unsigned int i;
+        for (i = 0; i < (1U << net->ipv4.tcp_metrics_hash_log) ; i++) {
+                struct tcp_metrics_block *tm, *next;
+                tm = rcu_dereference_protected(net->ipv4.tcp_metrics_hash[i].chain, 1);
+                while (tm) {
+                        next = rcu_dereference_protected(tm->tcpm_next, 1);
+                        kfree(tm);
+                        tm = next;
+                }
+        }
        kfree(net->ipv4.tcp_metrics_hash);
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b4c3582a991f..6f6d1aca3c3d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -758,7 +758,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
                uh->check = CSUM_MANGLED_0;
 send:
-        err = ip_send_skb(skb);
+        err = ip_send_skb(sock_net(sk), skb);
        if (err) {
                if (err == -ENOBUFS && !inet->recverr) {
                        UDP_INC_STATS_USER(sock_net(sk),
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5a439e9a4c01..bb9ce2b2f377 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1777,6 +1777,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
        .queue_xmit        = ip_queue_xmit,
        .send_check        = tcp_v4_send_check,
        .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
        .conn_request      = tcp_v6_conn_request,
        .syn_recv_sock     = tcp_v6_syn_recv_sock,
        .net_header_len    = sizeof(struct iphdr),
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ceaca7c134a0..8ac890a1a4c0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1079,7 +1079,7 @@ static void *packet_current_rx_frame(struct packet_sock *po,
        default:
                WARN(1, "TPACKET version not supported\n");
                BUG();
-                return 0;
+                return NULL;
        }
 }
@@ -1936,7 +1936,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
        if (likely(po->tx_ring.pg_vec)) {
                ph = skb_shinfo(skb)->destructor_arg;
-                BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
                BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
                atomic_dec(&po->tx_ring.pending);
                __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 9af01f3df18c..e4723d31fdd5 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -203,6 +203,34 @@ out:
        return index;
 }
+/* Length of the next packet (0 if the queue is empty). */
+static unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+        skb = sch->ops->peek(sch);
+        return skb ? qdisc_pkt_len(skb) : 0;
+}
+static void qfq_deactivate_class(struct qfq_sched *, struct qfq_class *);
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int len);
+static void qfq_update_class_params(struct qfq_sched *q, struct qfq_class *cl,
+                                    u32 lmax, u32 inv_w, int delta_w)
+{
+        int i;
+        /* update qfq-specific data */
+        cl->lmax = lmax;
+        cl->inv_w = inv_w;
+        i = qfq_calc_index(cl->inv_w, cl->lmax);
+        cl->grp = &q->groups[i];
+        q->wsum += delta_w;
+}
 static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                            struct nlattr **tca, unsigned long *arg)
 {
@@ -250,6 +278,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                lmax = 1UL << QFQ_MTU_SHIFT;
        if (cl != NULL) {
+                bool need_reactivation = false;
                if (tca[TCA_RATE]) {
                        err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
                                                    qdisc_root_sleeping_lock(sch),
@@ -258,12 +288,29 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                                return err;
                }
-                if (inv_w != cl->inv_w) {
+                if (lmax == cl->lmax && inv_w == cl->inv_w)
-                        sch_tree_lock(sch);
+                        return 0; /* nothing to update */
-                        q->wsum += delta_w;
-                        cl->inv_w = inv_w;
+                i = qfq_calc_index(inv_w, lmax);
-                        sch_tree_unlock(sch);
+                sch_tree_lock(sch);
+                if (&q->groups[i] != cl->grp && cl->qdisc->q.qlen > 0) {
+                        /*
+                         * shift cl->F back, to not charge the
+                         * class for the not-yet-served head
+                         * packet
+                         */
+                        cl->F = cl->S;
+                        /* remove class from its slot in the old group */
+                        qfq_deactivate_class(q, cl);
+                        need_reactivation = true;
                }
+                qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
+                if (need_reactivation) /* activate in new group */
+                        qfq_activate_class(q, cl, qdisc_peek_len(cl->qdisc));
+                sch_tree_unlock(sch);
                return 0;
        }
@@ -273,11 +320,8 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
        cl->refcnt = 1;
        cl->common.classid = classid;
-        cl->lmax = lmax;
-        cl->inv_w = inv_w;
-        i = qfq_calc_index(cl->inv_w, cl->lmax);
-        cl->grp = &q->groups[i];
+        qfq_update_class_params(q, cl, lmax, inv_w, delta_w);
        cl->qdisc = qdisc_create_dflt(sch->dev_queue,
                                      &pfifo_qdisc_ops, classid);
@@ -294,7 +338,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                        return err;
                }
        }
-        q->wsum += weight;
        sch_tree_lock(sch);
        qdisc_class_hash_insert(&q->clhash, &cl->common);
@@ -711,15 +754,6 @@ static void qfq_update_eligible(struct qfq_sched *q, u64 old_V)
        }
 }
-/* What is length of next packet in queue (0 if queue is empty) */
-static unsigned int qdisc_peek_len(struct Qdisc *sch)
-{
-        struct sk_buff *skb;
-        skb = sch->ops->peek(sch);
-        return skb ? qdisc_pkt_len(skb) : 0;
-}
 /*
 * Updates the class, returns true if also the group needs to be updated.
 */
@@ -843,11 +877,8 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
        struct qfq_sched *q = qdisc_priv(sch);
-        struct qfq_group *grp;
        struct qfq_class *cl;
        int err;
-        u64 roundedS;
-        int s;
        cl = qfq_classify(skb, sch, &err);
        if (cl == NULL) {
@@ -876,11 +907,25 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                return err;
        /* If reach this point, queue q was idle */
-        grp = cl->grp;
+        qfq_activate_class(q, cl, qdisc_pkt_len(skb));
+        return err;
+}
+/*
+ * Handle class switch from idle to backlogged.
+ */
+static void qfq_activate_class(struct qfq_sched *q, struct qfq_class *cl,
+                               unsigned int pkt_len)
+{
+        struct qfq_group *grp = cl->grp;
+        u64 roundedS;
+        int s;
        qfq_update_start(q, cl);
        /* compute new finish time and rounded start. */
-        cl->F = cl->S + (u64)qdisc_pkt_len(skb) * cl->inv_w;
+        cl->F = cl->S + (u64)pkt_len * cl->inv_w;
        roundedS = qfq_round_down(cl->S, grp->slot_shift);
        /*
@@ -917,8 +962,6 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 skip_update:
        qfq_slot_insert(grp, cl, roundedS);
-        return err;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 31b40cc4a9c3..dcd64d5b07aa 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -952,6 +952,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 */
                synchronize_rcu();
                INIT_LIST_HEAD(&wdev->list);
+                /*
+                 * Ensure that all events have been processed and
+                 * freed.
+                 */
+                cfg80211_process_wdev_events(wdev);
                break;
        case NETDEV_PRE_UP:
                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 5206c6844fd7..bc7430b54771 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -426,6 +426,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                          struct net_device *dev, enum nl80211_iftype ntype,
                          u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
+void cfg80211_process_wdev_events(struct wireless_dev *wdev);
 int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                 struct wireless_dev *wdev,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 26f8cd30f712..994e2f0cc7a8 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -735,7 +735,7 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
        wdev->connect_keys = NULL;
 }
-static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+void cfg80211_process_wdev_events(struct wireless_dev *wdev)
 {
        struct cfg80211_event *ev;
        unsigned long flags;